# Auth API

Authentication endpoints for OAuth2 login via Authentik.

## Authentication

These endpoints handle the OAuth2 flow. No prior authentication is required for `/auth/login` and `/auth/callback`.

---

## GET /auth/login

**Description:** Initiate OAuth2 login flow. Redirects to Authentik.

### Request

#### Query Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `next` | `string` | No | URL to redirect to after login |

### Response

#### Success (307 Temporary Redirect)

Redirects to Authentik OAuth2 authorization URL.

---

## GET /auth/callback

**Description:** Handle OAuth2 callback from Authentik.

### Request

#### Query Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `code` | `string` | Yes | Authorization code from Authentik |
| `state` | `string` | Yes | State parameter for CSRF protection |

### Response

#### Success (307 Temporary Redirect)

Sets session cookie and redirects to frontend.

#### Error (400 Bad Request)

```json
{
  "detail": "Invalid state parameter"
}
```

---

## GET /auth/me

**Description:** Get current authenticated user.

**Auth:** Required (session cookie)

### Response

#### Success (200 OK)

```json
{
  "id": "uuid",
  "email": "user@example.com",
  "name": "User Name",
  "avatar_url": "https://..."
}
```

#### Error (401 Unauthorized)

```json
{
  "detail": "Not authenticated"
}
```

---

## POST /auth/logout

**Description:** Log out current user.

**Auth:** Required (session cookie)

### Response

#### Success (200 OK)

Clears session cookie.

```json
{
  "message": "Logged out"
}
```